Skip to main content

76  Content Authenticity, Watermarking, and Synthetic Media Integrity

76.1 Chapter status

Field	Value
Chapter ID	content-authenticity-watermarking-and-synthetic-media-integrity
Exclusive job	preserve and interpret evidence about generated-output origin, edits, disclosure, and transformation
Claim label / support	Design rationale / argument
Current regulatory context	EU Article 50 transparency obligations are stated by the Commission to apply from 2 August 2026, subject to scope and transition details
Local evidence	architecture and planned transformation harness only
Last updated	2026-08-08

Source loading state for authenticity material: review covers C2PA 2.3, current EU transparency guidance, and the 2026 international risk synthesis. Standard conformance, legal interpretation, and measured robustness remain separate claims.

76.2 Drafting guardrail

“Authentic” is overloaded. A credential can be cryptographically valid while the depicted claim is false. A real photograph can be presented in a deceptive context. A synthetic image can be disclosed, consensual, and harmless. This chapter governs evidence about origin and transformation; it does not create a machine oracle for truth, consent, legality, or social meaning.

76.3 Human Reading Path

Concrete lens. The simpler baseline carries one green badge from a signed ingredient to the whole composite. The chapter instead binds each claim to its rendition or region and exposes unsupported transformations.

Supply-chain provenance tracks where models, code, data, and releases came from. Media integrity follows a different object: the text, image, audio, video, or multimodal artifact produced by a system, edited by later tools, and distributed through channels that may strip or rewrite its evidence.

Six signal families matter: signed provenance, watermarking, fingerprinting, statistical detection, visible disclosure, and contextual verification. Each answers a different question and fails differently. A signature identifies an assertion without proving it true. A watermark may fail after transformation, a detector may misclassify unfamiliar material, and a visible label may remain inaccessible or detached from the asset.

An authenticity envelope keeps those signals separate while joining identity, signer policy, content binding, edit history, detection, disclosure, consent, uncertainty, disputes, and remedy. Editing either preserves a verified link or creates an explicit lineage break.

Two asymmetric rules govern every downstream decision. Missing provenance does not prove synthetic origin, and valid provenance does not prove semantic truth. Layered evidence improves attribution, disclosure, correction, and accountability only when breaks, conflicts, false positives, and inaccessible labels remain as visible as successful validations.

76.4 Problem

Generative systems can create or modify media at scale, but downstream readers often see only the final bytes. Model identity, generation policy, edits, consent, source ingredients, and disclosure can disappear during export, re-encoding, screenshotting, platform upload, or deliberate laundering. That loss changes what any later observer may honestly infer.

The C2PA specification supplies a concrete interoperability mechanism: signed manifests, assertions, ingredients, actions, content bindings, and validation. The 2026 International AI Safety Report places content detection and disclosure inside a wider resilience system. The European Commission’s July 2026 Article 50 guidance makes the architecture operationally timely by distinguishing provider and deployer duties, machine-readable marking, deepfake labeling, and certain public-interest text. These sources have different authority. A technical standard is not law; official guidance is not a robustness result; an international report is not a local implementation.

76.5 Why existing approaches are insufficient

76.5.1 Signed provenance

Signed provenance answers: “Which entity signed which claims about this asset and its history, under this trust policy?” It can preserve generator identity, editing actions, ingredients, and validation status.

Failure mode: a compromised or authorized signer makes a false claim, or a viewer trusts the wrong root.

Non-claim: signature validity does not establish truth of depicted events, human authorship, consent, or harmlessness.

Source engagement: C2PA 2.3 makes content bindings and validation semantics concrete. Its strength is inspectable claim lineage; its limit is that claims remain claims.

Mechanism. A provenance verifier resolves the asset’s active manifest, checks the content binding, validates the signature and certificate chain under a named trust policy, evaluates timestamps and revocation state, reconstructs ingredient and action links, and returns typed findings for each assertion. The viewer must be able to distinguish “signature valid,” “signer trusted for this claim type,” “asset binding intact,” and “history complete enough for this use.” Collapsing those results into one badge destroys the reason provenance is auditable.

Failure mode. A legitimate production key can sign a misleading assertion, a platform can trust a root that another institution rejects, or a later edit can remain cryptographically linked while changing the meaning readers care about. Cached validation can also survive key revocation and keep a stale green label visible on derivative copies.

Non-claim. A valid C2PA-style chain does not establish that a photographed event occurred, that every ingredient was disclosed, that a depicted person consented, or that the signer had legitimate authority to make the claim. It is evidence about attributed statements and transformations under a policy.

Source grounding. C2PA 2.3 specifies manifests, assertions, ingredients, actions, content bindings, validation status, update manifests, and trust-chain processing. This analysis uses that concrete record model and its explicit failure semantics. It does not infer ecosystem adoption, honest signers, complete histories, or semantic truth from specification conformance.

76.5.2 Watermarking

A watermark embeds a signal in generated content. Useful properties include detection accuracy, perceptual quality, payload, robustness to transformation, key security, collision resistance, localization, and revocability. Text, image, audio, and video require different constructions and threat models.

Failure mode: cropping, paraphrase, re-generation, compression, noise, or adaptive optimization removes or forges the mark.

Non-claim: failure to detect a watermark does not prove human origin; successful detection does not identify every editing step or establish truth.

Mechanism. A watermark claim must bind the embedding algorithm, key or key class, payload semantics, model and version, media type, expected channel, detection threshold, calibration population, quality budget, and revocation policy. Robustness is reported as a transformation-conditioned curve rather than “survives editing.” The test matrix includes benign operations, distribution-platform processing, adaptive removal, mark copying, key compromise, and unmarked controls, with payload recovery separated from simple mark detection.

Failure mode. A system can optimize average detectability while imposing visible artifacts on minority languages or media styles, or it can survive compression but fail under a common crop, remix, dub, or paraphrase. A copied mark can falsely implicate a generator, and a public detector can become the objective against which an adaptive remover trains.

Non-claim. No watermark is treated as universal, indestructible, or mandatory for every modality. A mark provides one scoped signal; absence is ordinary when content predates the system, passes through an unsupported channel, or is produced by a different generator.

Source grounding. The International AI Safety Report places watermarking inside a layered synthetic-media defense that also includes provenance, detection, disclosure, education, correction, and institutional recovery. It supports the composition requirement, not a local robustness number or a finding that watermarking reduces deception in representative users.

76.5.3 Fingerprinting

Fingerprints associate an artifact or generator with a learned or computed signature without necessarily embedding new data. They can support duplicate detection, known-model attribution, or incident clustering.

Failure mode: updates, fine-tunes, codecs, and distribution shift invalidate the fingerprint; a shared base model creates ambiguous attribution.

Non-claim: similarity is not custody lineage unless a signed or otherwise verified chain provides it.

Mechanism. A fingerprint record states what object is being attributed: exact file, near duplicate, generator family, model checkpoint, editing pipeline, or campaign cluster. It freezes the feature extractor, reference corpus, matching rule, threshold, open-set policy, and evaluation date. Attribution must include alternative candidates and an “unknown” route; nearest-known is not equivalent to known origin. Operational use should preserve the original similarity evidence so a challenged decision can be replayed after the reference set changes.

Failure mode. A shared base model, common codec, stock template, or platform post-processing can dominate the signal and create confident but spurious attribution. Fine-tuning or model updates can move the generator away from its stored profile, while campaign clustering can accidentally merge unrelated creators who use the same tool.

Non-claim. Fingerprinting does not establish authorship, intent, custody, consent, or truth. Even accurate generator-family attribution cannot show which person invoked the system or which edits occurred after generation.

Source grounding. The International AI Safety Report treats detection and attribution as incomplete, distribution-sensitive defenses rather than truth oracles. This treatment extends that boundary to fingerprint identity and open-set refusal; the report supplies no endorsed fingerprint algorithm and no local false-attribution rate.

76.5.4 Statistical detection

Detectors estimate whether content belongs to a learned class. They can be useful where provenance is absent. Their thresholds, populations, models, languages, compression levels, and dates are part of the result.

Failure mode: distribution shift creates false accusation or missed synthetic content; an adaptive generator trains against the detector.

Non-claim: a detector probability is not a fact about authorship, and it must not silently become a disciplinary or legal decision.

Mechanism. Detector evaluation begins by specifying the decision population: modality, language, genre, generator families, human author groups, compression channels, prevalence, and date. Calibration, discrimination, and abstention are reported separately. Thresholds are decision-specific because a content-moderation queue and an accusation against a person have radically different false-positive costs. The production record retains model version, input rendition, score, threshold, uncertainty, and the human or contextual evidence used after the score.

Failure mode. A balanced benchmark can hide the low base rate of synthetic content in a real population, turning a respectable false-positive rate into many more false accusations than true detections. Generator updates, translation, post-editing, or adversarial paraphrase can invalidate calibration. Reviewers may then anchor on the numerical score even when the model is out of scope.

Non-claim. Statistical detection cannot certify human authorship, identify a generator absent a validated attribution task, or replace corroboration. A score may justify routing to review; it cannot by itself justify punishment, removal, or public labeling.

Source grounding. The International AI Safety Report emphasizes that synthetic-media safeguards remain bypassable and incompletely tested and that detection must be combined with wider resilience measures. This design adopts that uncertainty and layered-use boundary; it does not import any source-reported detector performance as a current capability.

76.5.5 Visible disclosure

Labels communicate generation or manipulation to people. They require placement, persistence, comprehensibility, accessibility, localization, and a definition of what is being disclosed.

Failure mode: tiny, temporary, ambiguous, or inaccessible labels satisfy a checkbox while users remain misled.

Non-claim: disclosure does not eliminate manipulation or establish informed understanding.

Mechanism. A disclosure contract records the exact statement shown, actor responsible for displaying it, placement, duration, language, modality, accessibility representation, asset or region bound by the label, and conditions under which the label survives embedding or redistribution. Test comprehension with representative users, including whether they can explain what was generated or manipulated and what the label does not establish. Machine-readable marking and human-visible disclosure remain separate fields because different actors may own them.

Failure mode. A generic “AI used” notice can obscure whether the entire asset, one component, or a trivial edit was synthetic. Labels can vanish below the fold, during screen-reader navigation, or after a platform embed. Repeated warnings can also produce fatigue while a dramatic badge overstates certainty.

Non-claim. Label presence does not prove comprehension, prevent deception, or satisfy a legal duty. The correct statement, placement, and responsible actor depend on the exact system, content, use, jurisdiction, and current rules.

Source grounding. The European Commission’s Article 50 guidance distinguishes provider marking from deployer disclosure and identifies deepfakes and specified public-interest text as particular cases. This analysis uses that role separation and action-time versioning. The guidance is not legal advice for this project and does not demonstrate that any label changes user belief.

76.5.6 Contextual verification

Journalistic verification, source corroboration, reverse search, chronology, location, witness evidence, and domain expertise remain essential. Provenance can strengthen that work but cannot replace it.

Mechanism. Contextual verification constructs competing explanations for the asset and seeks independent evidence that is not produced by the same generator, signer, platform, or detector. The record can include source contact, earlier renditions, geolocation and chronology, physical constraints, known event footage, witness testimony, editorial judgment, and unresolved conflicts. Each conclusion names which checks were actually performed and which would still change it.

Failure mode. Several apparently independent signals may share one upstream source: news articles quote the same post, reverse-search indexes derivatives of the same upload, and a platform detector consumes provenance supplied by the platform. Counting those as corroboration converts correlated repetition into false confidence.

Non-claim. Contextual verification does not guarantee truth or eliminate editorial error. It supplies a challenge path when technical signals are missing, conflicting, or compromised and should preserve an unknown outcome when the independent record is insufficient.

Source grounding. The International AI Safety Report places education, correction, provenance, disclosure, and detection inside a broader resilience response. This treatment interprets that synthesis as a requirement for independent contextual checks; the report does not certify any newsroom, platform, or verifier as complete or unbiased.

76.6 Core Claim

Reader claim. Authenticity evidence can show who asserted what about an asset and how its bytes changed. It cannot, by itself, show that the depicted event is true or that missing provenance means the asset is synthetic.

Operational rule. Preserve provenance, watermark, fingerprint, detector, disclosure, and contextual evidence as separately typed signals. After every transformation, either verify the lineage, record a derivation, expose a break, or retain an unresolved relationship; never turn absence or signature validity into a truth verdict.

[content-authenticity-watermarking-and-synthetic-media-integrity.core, label: Design rationale, support: argument] Synthetic-media integrity should use a layered authenticity envelope that binds asset identity, generator and editor claims, signed provenance, content bindings, watermark or fingerprint signals, detector outputs, visible disclosure, transformation history, trust policy, uncertainty, and remedy; every signal retains its own semantics, and no missing or valid signal becomes a universal truth judgment.

76.7 Mechanism

76.7.1 Worked transformation: a valid ingredient enters an unbound composite

Suppose an editor imports a photograph with a valid signed provenance chain, crops it, places generated material beside it, and exports through a tool that cannot bind regions in the composite. A one-badge design carries the green credential forward and makes the whole image look endorsed. The envelope does something less convenient and more honest: it assigns the export a new rendition identity, retains the photograph as a credentialed ingredient, records the crop and composite actions, and marks the region-to-output link as unsupported. The generated region receives only the signals actually attached to it. That adjudication yields neither “verified image” nor “fake image”; it yields a mixed artifact with one supported ingredient and one explicit lineage break.

The repository tests that distinction with the authored envelope in tests/fixtures/proof_models/content_authenticity_envelope.json. Its review separates the evidence types, accounts for four declared transformations, and rejects 42 single-axis mutations with an exact repair or refusal disposition. It also proves two deliberately uncomfortable boundaries: identical technical signals can coexist with opposite semantic truth, and missing signals cannot identify human or synthetic origin. Those are finite consequences of authored fields—not a test of a real signer, editor, watermark, detector, platform, or viewer—but they make the reader-facing rule executable and falsifiable.

76.7.2 The authenticity envelope

flowchart LR
  G["Generation or edit event"] --> P["Signed provenance and content binding"]
  G --> W["Optional watermark / fingerprint"]
  P --> T["Transformation ledger"]
  W --> T
  T --> V["Validation under declared trust policy"]
  T --> D["Detector and contextual evidence"]
  V --> U["Accessible visible disclosure"]
  D --> U
  U --> R{"Conflict, harm, or dispute?"}
  R -- "yes" --> C["Correct, reattribute, notify, remove, or preserve for review"]
  R -- "no" --> H["Bounded downstream use"]
  C --> L["Residual and lineage update"]

How to read the synthetic-media authenticity envelope: generation creates separate provenance and auxiliary-signal paths that meet only after real transformations are recorded. Validation and contextual detection feed an accessible disclosure; disputes route to correction and lineage updates, while an undisputed result earns only the bounded downstream use allowed by its trust policy.

An envelope is a set of typed evidence, not one score. At minimum it records:

• asset and rendition identifiers;
• signed claims and signer chain;
• generator, editing tool, and model claims where available;
• ingredient and action history;
• content-binding method and validation state;
• watermark/fingerprint detector identity, threshold, and result;
• statistical detector identity, calibration population, and result;
• visible disclosure text, location, language, and accessibility;
• known transformations and explicit lineage breaks;
• consent, privacy, and rights references where authorized;
• conflicts, uncertainty, expiry, and remedy route.

76.7.3 Transformation is the central engineering problem

An authenticity system that works only on the first exported file will fail in ordinary media pipelines. Evaluate at least:

Transformation	Provenance question	Watermark/detector question
resize / crop	can the new rendition link to its ingredient?	does localization or detection survive?
lossy re-encode	is the binding method compatible?	what quality/robustness tradeoff appears?
edit / composite	are ingredients and actions preserved?	can signals distinguish regions or sources?
metadata stripping	is the break explicit to the viewer?	does an auxiliary signal remain?
screenshot / analog capture	can a new claim link back probabilistically or manually?	what false-positive cost follows?
translation / paraphrase	is semantic lineage represented honestly?	does a text mark survive without degrading language?
model regeneration	is the result a new generation event?	can inherited-looking signals be laundered?

Every unsupported transformation creates a break, not a guessed link. Platforms may issue a new manifest that names the prior asset as an ingredient; they must not claim the original signer authorized later edits unless the chain says so.

Mechanism. Every transformation produces a new rendition identity and one of four dispositions: verified preservation, verified derivation, explicit lineage break, or unresolved relationship. The transformer records its action, input binding, output binding, retained assertions, newly asserted claims, and validation result. For composite media, region- or ingredient-level lineage prevents one valid component from laundering the whole output. For analog capture or screenshot, a new claim may point to a probabilistic or manually reviewed predecessor, but never recreates the missing cryptographic link.

Failure mode. Platforms can silently normalize, strip, or regenerate media while presenting the original badge; editors can import a credentialed asset and imply that the source signer endorsed the composite. Unsupported tools can also drop history without making the break visible, leaving downstream users to mistake absence for human origin.

Non-claim. A complete transformation ledger does not establish consent, truth, or legitimacy of the edits. An explicit break is not a determination that content is fake; it is an honest statement that the prior technical chain no longer supports the requested inference.

Source grounding. C2PA 2.3 defines ingredient and action histories, content bindings, update manifests, and validation states. Those mechanisms ground the four-disposition model. The specification does not prove that ordinary tools retain metadata, that cross-platform chains interoperate, or that users understand lineage breaks.

76.7.4 Trust policy and validation

A viewer needs a trust policy: which roots, signers, algorithms, timestamps, revocation information, and claim types are accepted for which decision. Validation should return typed states such as valid, invalid, unsupported, expired, revoked, incomplete, conflicting, and absent. “Green check” is too coarse.

Compromise response needs to propagate. If a signing key or trust root is revoked, affected manifests, cached decisions, platform labels, and derivative claims must be re-evaluated. Historical evidence should remain available for authorized investigation with its invalidation state, not disappear.

76.7.5 Regulation is an interface, not a design substitute

The European Commission states that Article 50 transparency obligations apply from 2 August 2026 and distinguishes machine-readable marking, deepfake and specified public-interest disclosure, provider and deployer roles, scope, and transitional details. The architecture should therefore expose:

• the provider that generated or manipulated content;
• the deployer that presents or publishes it;
• the content and jurisdictional scope;
• machine-readable marking state;
• visible-label state;
• exemptions or transitional basis asserted;
• evidence retained for the decision;
• current legal-policy version and review date.

The system must recheck official law and guidance at action time. This chapter does not decide legal scope, give legal advice, or claim that C2PA, a watermark, or a label alone satisfies any obligation.

Mechanism. Treat regulatory classification as a versioned decision record rather than a boolean compliance field. It binds provider, deployer, system, content class, jurisdiction, relevant legal text and guidance version, machine-readable marking, visible disclosure, asserted exception or transition, reviewer authority, evidence, expiry, and remedy. A changed role, distribution channel, guidance version, or content use reopens the decision. Technical components report facts into that record but cannot decide scope.

Failure mode. One organization can copy a provider’s marking receipt into a deployer’s disclosure obligation, or treat a valid C2PA credential as proof that a label is accessible and legally adequate. Static compliance logic can also survive the date on which new obligations begin or guidance changes.

Non-claim. The architecture does not state that this book, a model, a platform, or an individual asset falls within Article 50; it gives no legal advice and makes no compliance determination. It preserves the distinctions a qualified decision maker needs.

Source grounding. The Commission’s July 2026 guidance states that Article 50 transparency obligations apply from 2 August 2026 and distinguishes provider and deployer responsibilities, machine-readable marking, deepfake disclosure, and specified public-interest text. The chapter records that current official context while requiring action-time rechecking and preserving scope, exemption, transition, and legal-authority uncertainty.

76.7.6 Conflict resolution and remedy

Authenticity systems are most important when their signals disagree. A valid manifest may coexist with a failed watermark, a detector may flag an asset whose provenance is absent, or a platform may display a label after the signer has been revoked. The decision record should preserve each observation, timestamp, trust policy, and affected rendition rather than overwrite the conflict with a majority vote. Low-stakes presentation can show uncertainty; high-impact removal, accusation, or legal escalation requires a separately authorized review route with an opportunity to challenge the evidence.

Correction is also a lineage event. A platform that changes attribution, removes a false label, restores an asset, or publishes a clarification should issue a new decision record linked to the superseded one. Cached labels, search results, content-delivery copies, archives, and downstream partners need an affected-path notification with expiry and residual ownership. “Corrected at source” is not complete when a harmful or accusatory derivative remains visible elsewhere.

Remedy must match the type of failure. A creator falsely labeled as synthetic needs prompt contestation and restoration; a person depicted without consent needs privacy and likeness routes; a news audience misled by a validly signed false claim needs correction and contextual evidence; a compromised signer requires trust-store invalidation and re-evaluation. The authenticity envelope routes these cases but does not decide damages, criminal liability, platform policy, or legal rights. Its job is to keep the technical evidence, decision, correction, downstream propagation, and unresolved harm joinable.

76.7.7 Privacy, consent, and accessibility

Provenance can leak identity, location, workflow, device, or editing history. Minimize public claims, separate public and restricted assertions, and use selective disclosure where supported. Do not expose a victim or confidential source merely to make a provenance graph complete.

Visible disclosure must work for screen readers, low vision, hearing differences, localization, small screens, and transformed embeds. Test whether people understand what was generated or changed; label presence is not the same as comprehension.

Consent and likeness require a separate rights record. A credential can state that consent was asserted and by whom. It cannot prove that consent was informed, valid, uncoerced, current, or legally sufficient without the corresponding governance process.

76.8 Interfaces

The envelope is a cross-layer object, but each neighbor retains its own decision. Supply-chain evidence identifies the generator and official artifacts; privacy governs whose identity and likeness may travel; epistemic security reasons about deception and belief; institutions interpret legal duties; resilience responds to harm at scale. A consumer must preserve signal, trust-policy, transformation, channel, and affected-party identities rather than importing a generic “verified” flag.

• AI Supply-Chain Integrity owns model, code, data, and dependency provenance. This chapter owns generated-output and edit provenance.
• Privacy, Data Rights, and Information-Flow Governance controls identity, likeness, consent, retention, disclosure, and remedy.
• Human-AI Communication and Epistemic Security uses authenticity evidence when assessing persuasion and public knowledge.
• Institutions and Public Legitimacy owns legal interpretation and accountable rulemaking.
• Societal Resilience coordinates response after deceptive content spreads.

76.9 Invariants

These invariants make degraded and conflicting evidence visible. They prohibit the two most dangerous shortcuts: treating missing provenance as proof of fakery, and treating valid provenance as proof of truth. They also require accessible disclosure and contestation so an authenticity system cannot count a machine-readable success that the relevant person could not perceive, understand, or challenge.

• Provenance, watermark, fingerprint, detector, disclosure, and contextual verification remain distinct evidence types.
• A valid signature proves only a signed claim under a named trust policy.
• Absence of a credential or mark proves neither synthetic nor human origin.
• Each transformation preserves a verified link or records an explicit break.
• Conflicts and invalid states remain visible to downstream consumers.
• Disclosure is perceivable, understandable, accessible, and attached to the relevant asset and context.

76.10 Failure modes

76.10.1 Strongest objection

The strongest objection is the analog hole: anyone can screenshot, re-record, or regenerate media, so durable provenance will never cover everything. The objection has teeth. A simpler baseline—visible labels and ordinary verification—may beat a complex credential stack where ecosystem support is poor. The chapter’s answer is graceful degradation, not perfect coverage. When provenance disappears, the system says so and falls back to detector, context, and institutional verification without treating uncertainty as guilt.

Additional failures include signer compromise, trust-list fragmentation, metadata stripping, false credentials, watermark removal, detector drift, model-update drift, collision, copied labels, privacy leakage, inaccessible disclosure, provenance spam, platform lock-in, remedy failure, and compliance theater.

76.11 Minimum Viable Implementation

Create a public-safe asset corpus with human, generated, edited, and composite examples. Attach signed test manifests, visible labels, and a toy auxiliary mark. Run crop, resize, re-encode, edit, metadata-strip, screenshot, and regeneration transforms. Record signal survival, false positives, false negatives, validation states, lineage breaks, and user comprehension. Include compromised-signer, validly-signed-false-claim, absent-credential, conflicting- claim, privacy-redaction, and correction fixtures.

Use at least two independent authoring tools, validators, and distribution paths so the exercise tests interoperability rather than a single vendor’s round trip. Blind evaluators to origin when measuring detector calibration and human comprehension. Publish the transformation matrix, complete denominator, accessibility results, privacy removals, unresolved conflicts, and correction latency. The exercise validates a bounded content-evidence pipeline; it does not establish universal origin detection or public trust.

76.12 Mature Research Target

The mature system gives every governed output a portable authenticity envelope that survives ordinary workflows where possible and degrades honestly where it cannot. Readers can inspect what is claimed, by whom, under which trust policy, through which transformations, with which auxiliary signals, and with what uncertainty. Affected people can correct or contest the record. The design supports current transparency duties without turning compliance into a false truth oracle.

At maturity, authoring, editing, publishing, messaging, archival, and forensic tools preserve a portable chain where possible and emit an explicit break where not. Trust policies can differ by jurisdiction and use while validators show exactly which signer, assertion, binding, and transformation was accepted. The user sees a useful explanation, not merely a cryptographic success code.

The system combines provenance with calibrated auxiliary evidence. Watermarks, fingerprints, and detectors are tested under realistic editing, regeneration, laundering, and adaptive removal; none is required to be indestructible. Conflicts route to contextual verification and remedy rather than an automatic accusation. Privacy-preserving disclosures reveal only what the decision requires.

The state-of-the-art outcome is not perfect synthetic-media detection. It is a degrading-honestly evidence network that improves attribution and correction, reduces false certainty, survives ordinary transformations at measured rates, and gives affected people practical contestation without creating a universal identity or surveillance layer. This remains a research target until interoperable tools, adversarial transformations, representative users, and real remedy pathways have been evaluated together.

76.12.1 Formalization hooks

The implemented target lean:content-authenticity-watermarking-and-synthetic-media-integrity.admission_boundary is realized by AsiStackProofs.ContentAuthenticityReview. Its 32 theorem declarations cover an eight-transition envelope review, 42 admission-axis mutations with exact repairs, typed evidence non-substitution, finite transformation accounting, trust-policy and signer-revocation staleness, scoped receipt invalidation, unsupported-transformation and unbound-composite rejection, a semantic-truth impossibility result, an origin-from-absence impossibility result, and a communication-consumer bridge that refuses to inherit recipient comprehension from an authenticity receipt.

The proof is intentionally bounded. It trusts the authored asset, signer, policy, transformation, disclosure, remedy, and revocation fields. This model does not prove signature correctness, provenance completeness, watermark or detector robustness, content truth, human or synthetic origin, authorship, consent, comprehension, legal compliance, remedy efficacy, interoperability, deployment safety, or social benefit. Chapter support remains argument. The next evidence step is a Project Theseus authenticity campaign over independent authoring and validation tools, adversarial transformations, compromised signers, accessible disclosures, correction propagation, and representative users.

76.13 Codex test plan

Test	Purpose	Status
Evidence-type separation	Reject a record that collapses signature, watermark, detector, and truth into one field.	implemented in Lean and the independent 42-axis validator
Transformation matrix	Exercise ordinary and adversarial transformations and preserve explicit lineage breaks.	finite accounting and rejection properties implemented; natural transformations remain planned for Theseus
Signed-false-claim control	Prove that cryptographic validity does not force semantic-truth status.	implemented as a universal non-identifiability result
Missing-signal control	Reject inference of human or synthetic origin from absence alone.	implemented as a universal non-identifiability result
Trust revocation	Propagate signer/root invalidation to cached and derivative decisions.	scoped receipt and monotonic staleness properties implemented; deployed propagation remains planned
Accessibility and remedy	Check visible disclosure, correction, and harmed-party routes.	planned
No-promotion control	Prevent standards conformance or prose from becoming a robustness, compliance, or truth claim.	implemented for the authored envelope and communication consumer

76.14 Source crosswalk

Source ID	Bounded use	Non-authority
ext_c2pa_specification_2_3_2025	signed manifests, assertions, ingredients, content bindings, and validation	does not prove semantic truth, consent, or universal retention
ext_eu_article_50_transparency_guidelines_2026	current provider/deployer, marking, deepfake, and disclosure context	not legal advice, scope decision, or compliance proof
ext_international_ai_safety_report_2026	synthetic-media risk, detection, disclosure, correction, education, and resilience synthesis	no local detector or intervention result

76.14.1 Manifest source assignment reconciliation

These rows keep Content Authenticity, Watermarking, and Synthetic Media Integrity’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Supplies Corben’s capability-compilation lineage for exact artifact identity, transformation provenance, declared semantics, verification boundaries, and residual-preserving handoffs.	Author-side architecture lineage only; it does not establish C2PA conformance, watermark robustness, detector accuracy, content truth, consent, legal compliance, or public trust. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

76.15 Summary

Synthetic-media integrity is not solved by an indestructible watermark because no such universal signal exists. It is improved by composing typed evidence: signed provenance, content bindings, bounded watermarks and fingerprints, calibrated detectors, visible disclosure, contextual verification, transformation history, and remedy. The envelope’s honesty is as important as its coverage.

Readers should therefore ask what exact claim was signed, how it binds to the asset, which edits and distribution steps remain linked, what auxiliary signal was measured under which threshold, who set the trust policy, what a missing signal means, and how a harmed person can correct the record. The authenticity layer’s answer is layered evidence with visible breaks—not a single badge that decides truth, human authorship, consent, or harmlessness. It also keeps false attribution, inaccessible disclosure, signer compromise, and unresolved conflict visible to every downstream consumer.

76.16 Handoff

Governed Operations, Incident Command, and Graceful Degradation follows. It receives validation failures, compromised signers, large-scale laundering, disclosure outages, and correction obligations. It does not receive a claim that unauthenticated content is false or authenticated content is true. The handoff preserves asset, generator, credential, watermark, detector, transformation, channel, affected-party, incident, remedy, uncertainty, and expiry identities so operations can contain a concrete failure without laundering an evidence signal into truth. Receipt completeness proves neither detector transfer, signer integrity, platform cooperation, successful correction, reduced harm, nor readiness for broad deployment.